Loading story…
Cybercriminals are launching thousands of education-themed fraudulent websites and phishing campaigns ahead of the 2026 academic year, impersonating school-related services to steal personal and financial information from students, parents, and educators. The activity exploits back-to-school processes and the heightened volume of education-related communications during enrollment and term preparation.
Check Point Research reported that educational organizations sustained an average of 4,696 cyberattacks per organization per week from January through July 2026—an 8% increase from the comparable 2025 period and more than double the 2,150 weekly cross-industry average. Education is therefore the most targeted sector globally, requiring schools and families to verify school portals and payment requests before submitting credentials or financial data.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Cybercriminals created thousands of fraudulent education-themed websites and associated phishing campaigns ahead of the 2026 academic year. The campaigns target students, parents, and educators to steal personal and financial information.
From January through July 2026, educational organizations experienced an average of 4,696 cyberattacks per organization per week, according to Check Point Research. This was 8% higher than the comparable 2025 period and more than twice the global cross-industry average of 2,150 weekly attacks.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The education sector has become the most targeted industry for cyberattacks globally, with Check Point reporting that schools, colleges, universities, and research institutions averaged **4,696 weekly attacks** from January through July 2026—well above the cross-industry average and up 8% year over year. Researchers said attacker activity is intensifying ahead of the academic term, with **18,954** newly registered education-related domains observed in July and the share flagged as malicious worsening from **1 in 305** in June to **1 in 226** in July. Regional pressure was strongest in APAC by attack volume, while Europe and Latin America saw notable growth. Threat actors are using education-themed phishing, credential theft, and malware delivery to exploit routine school workflows and trusted brands. Observed lures included fake student discount and reward sites, spoofed education and government portals, and malicious PDFs that redirected victims to counterfeit **Microsoft 365** and **OneDrive** login pages designed to harvest credentials. Researchers also identified malware distribution through a compromised school website in Bangladesh, underscoring how attackers are combining fraudulent domains with abused legitimate infrastructure to target students, staff, and institutions for account compromise and theft of personal and financial data.
Aug 20, 2026
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026
The UK Department for Education confirmed a cyber attack after a previously unknown group, **ExfilSquad**, claimed it had stolen about **607,000 records** from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a **data-theft-and-extortion** operation. The department said it had contained the incident and was working with the **National Cyber Security Centre** and **National Crime Agency** on the investigation. The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by **49% of primary schools**, **73% of secondary schools**, **88% of further education colleges**, and **98% of higher education institutions**. **Phishing** remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in **supply-chain security** and **patch management**, combined with budget and staffing constraints and rising concern over **AI-enabled social engineering**, continue to leave the sector exposed.
Aug 11, 2026